KETJU Research

← The Register

stable-lending

Venus Protocol

Rejected
Max sleeve
—
Reviewed
2026-08-14 · v1
Next review
2026-11-14
Research basis
Individual research
Chains
BNB Smart Chain · freezable

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED on loss record and chain policy. The earlier memo mixed protocol losses with a September 2025 phishing compromise of an individual user and overstated the May 2021 shortfall as $95M; Venus’s own post-mortem puts protocol loss near $77M. The corrected primary record remains disqualifying: the 2021 XVS collateral event, the May 2022 LUNA oracle freeze and roughly $14.2M shortfall, the 2023 snBNB oracle shortfall, the 2025 wUSDM donation attack with $716,789 net loss, the October 2025 WBETH oracle-depeg liquidations requiring compensation, and the March 2026 THE supply-cap bypass and price manipulation. Venus V4 adds isolated pools, multi-source oracle validation, risk funds and multiple governance routes, but the assigned Core Pool still mutualizes collateral, oracle and liquidity risk across markets. In March 2026 governance proposed repaying about $2.20M of remaining Core Pool bad debt across 19 assets from treasury and risk-fund resources. BNB Smart Chain is independently outside this mandate, and the repeated realized shortfalls make the refusal stronger.

The research file

Mechanism and risk unit

Venus Core Pool follows a Compound-style pooled lending design. Suppliers receive vTokens, borrowers enable supported assets as collateral, and the Comptroller applies collateral factors, liquidation thresholds, close factors and market pauses. Borrow rates follow each market’s interest-rate model and withdrawals redeem vTokens only against cash currently available in that market. The Resilient Oracle can compare primary, secondary and pivot sources, but the Comptroller still accepts the resulting value as the basis for borrowing power and liquidation. Unlike an isolated-pool position, a fragile collateral listed in the Core Pool can borrow liquid assets from the same shared venue. The underwritten unit is therefore the complete live Core Pool collateral and oracle set, not merely the stablecoin a client intends to supply.

Governance and privileged control

Staked XVS voting power drives Governor Bravo proposals that queue actions through timelocks. Venus V4 divides proposals into normal, fast-track and critical routes, adds an AccessControlManager and exposes fine-grained pause authority. The current deployment page identifies separate normal, fast-track and critical timelocks, three guardians for risk parameters, pausing and oracles, an omnichain executor and risk-steward contracts. Normal proposals are documented with a 48-hour timelock; faster routes deliberately shorten response time for defined actions. Governance can list collateral, alter caps and factors, upgrade contracts, change oracle configuration, pause markets and deploy treasury or risk-fund assets. These powers are mitigations during an incident but also determine the supplier’s live risk set.

Realized loss and incident record

Venus’s May 2021 post-mortem reported about $77M of protocol loss after XVS-driven liquidations and acknowledged missing oracle deviation controls and management failures. In May 2022, suspension of the LUNA Chainlink feed left a price disparity; Venus paused the protocol and reported an initial shortfall of about $14.2M. A December 2023 snBNB oracle configuration incident produced roughly $274,000 of shortfall. The February 2025 wUSDM donation attack created $902,159 bad debt and a $716,789 net cost after recovered liquidation fees. October 2025 WBETH price-feed deviation caused erroneous liquidations and a governance compensation process. Finally, the March 2026 THE attack combined direct-donation supply-cap bypass, thin-market price manipulation and concentrated collateral; governance described about $2.20M of total Core Pool bad debt to clear. This is a repeated underwriting record.

Mitigations and remaining assurance gap

The current system is materially different from 2021. Venus publishes scoped audits, isolated pools, a Resilient Oracle, caps, pause controls, risk stewards and pool-level risk funds. The shortfall system can stop interest accrual, write off bankrupt accounts and auction risk-fund assets for the debt. Those are substantive controls, not marketing labels. They do not erase the Core Pool record or guarantee full recovery: Venus documentation says an auction may cover only part of bad debt when the risk fund is smaller than the shortfall. The March 2026 incident occurred after several V4 controls existed and exploited the interaction of a Compound-fork donation path, supply-cap enforcement and two price sources that converged on an illiquid manipulated market. Control count is not equivalent to demonstrated loss prevention.

Exit, liquidity and alternatives

A supplier exits by redeeming vTokens for the underlying market cash. High utilization can make redemption fail until borrowers repay or new suppliers add cash; the liquidation documentation separately records pending protocol-share redemptions when available cash is insufficient. Pauses can also restrict actions during an incident. A stablecoin supplier is therefore exposed to withdrawal timing and every accepted Core Pool collateral path, even without borrowing. The named alternatives are Aave V3 on an approved chain for a mature pooled market, or a specifically underwritten Morpho vault when isolation and curator limits are preferred. Neither alternative is risk-free, but each avoids this mandate’s BNB Chain exclusion; a named isolated venue also avoids inheriting Venus Core Pool’s entire collateral history.

Observable reopening conditions

Reopen only if the target is a named Venus market on an approved chain or the chain policy itself changes; a generic multichain deployment is insufficient. Require at least twenty-four months without new bad debt, oracle-caused liquidation or supplier loss across the relevant pool. Publish per-market bad-debt, liquidation, utilization and withdrawal-failure history, and reconcile every collateral, cap, oracle source, guardian and timelock to current contracts. The pool’s readily realizable risk fund must cover the written stress loss without discretionary treasury support. A proposed-size stablecoin withdrawal and liquidation simulation must pass during stressed utilization. Until every condition is observed together, zero allocation and the rejected verdict remain appropriate.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.

ChainVerdictGradeControl constraint
BNB Smart ChainRejected freezable the validator set concentrates around one company, and the chain has been halted by decision.
The memo is public. The watching is the product: the terminal reads your clients’ wallets against this Register and flags the events above when they fire. $49 per advisor per month, first 14 days free. Start the trial.